PC-3000 SAS V. 5.0.2 and Data Extractor V. 4.8.28 released

PC-3000 SAS kernel

PC-3000 SAS software has been redesigned completely to support operations with SAS HDD via the kit 4-channel SAS controller and with SCSI HDD via third party controllers; limited support for SATA, ATA, USB HDD on third party controllers has also been implemented

Optimized work with a new map type considerably accelerating operations with it and improving memory consumption

Optimized work with the map during statistics calculation/updates considerably accelerating these processes

Added support for the previous format of map description storage

Optimized the algorithm of submap generation for the new map file type (considering the drive heads)

NTFS:

- Revised the map generation mechanism for files with nonresident attribute $20 in cases when a part of the attribute is "lost". The map is now built to include information up to the attribute corruption - Added the opportunity to generate a submap for drive heads without combining the chains from different heads - Raw recovery mode, added detection of RAW formats of digital cameras earlier recognized as TIFF

VMFS:

- Implemented scanning method for FDC (file descriptor cluster) files - Implemented the method for generation of the used/unused space maps - Added support for the storage method for files smaller than 1 Kb in VMFS5

FAT file system:

- Enhanced the new partition analysis method with the option to read tables in case of copy creation, and optimized the method of initial parsing for revealed tables

EXT(2, 3, 4) file system:

- Enhanced the partition analysis method with the option to consider InodeBitmap during the procedure. The method has been deeply optimized resulting in significantly accelerated performance - Added the option to 'Show deleted objects' for the native file system

Added a new alternative (and more compact) map implementation for tasks with enabled copy creation option. Map variation is selected during task creation (previous format - 'Binary file'). The default value can be configured in the settings menu of the Data Extractor task manager. New map format has been supplemented with redundancy fields, which allow map recovery in case of key metadata corruption. Implemented a recovery mechanism

Added buttons for quick control of reading taking into account the heads map (they appear on the panel to the right after the heads map is built)

Enhanced the task window with a quick access button activating the main windows of the suite (window of the current utility for the task, PC3000 and DE managers)

Added termination of the copy creation process upon selection of the 'Work with copy' option

Added automatic map redrawing after read operation

Implemented general control of recursive links in file systems and their correct handling while saving files/directories or generating their maps

- Considerably increased performance due to multithreaded execution - Added opportunity to cancel the procedure - Fixed the error (presumably) preventing some users from activating the mode all the time or part of the time

- In the 'Partition analysis' and 'Search NTFS structures' modes the 'linking' mechanism based on extend information has been modified. Previous implementation could run out of RAM in some very rare cases - Introduced some changes in the procedure saving compressed files, now an incorrectly unpacked block is filled with $00, but saving is not interrupted. The program adds a corresponding record to the error log - Fixed the error introduced in the latest beta version causing incorrect generation of a map for a compressed file (although actual saving was performed correctly) - Added Volume output for NTFS partitions - Added the $Bitmap file map menu item - Fixed the error in the map generation procedure for some files within large partitions (discovered in a partition of 12Tb) - Changed the mechanism parsing multiple $30 attributes in the MFT scanning mode. Previous variation used to leave just one out of several links pointing to directories - Considerably accelerated the first stage (search for structures) in the Partition analysis mode used with NTFS partitions - Removed excessive output of the string containing the compressed file name to log

Ext4 file system:

- Implemented an optional opportunity to take into account 'block group flags' while generating the maps of used/unused space, metadata map, and partition data analysis - Revised directory parsing due to the existence of certain operating system versions with noncompliant Inode flags and directory storage forms - Fixed the problem causing interruption of directory parsing within a native file system in case of certain errors in the structure of its metadata - Fixed the error in parsing of dx_ directories consisting of multiple extends - Fixed the error in the parsing implementation for 48-bit addresses. It was revealed on a 64 Tb partition

FAT file system: added the opportunity to analyze a partition using an external file as a FAT source

VMFS: added support for the native file system

ReiserFS:

- Enhanced addition of a virtual partition during quick drive analysis and raw recovery (making it smarter) - Fixed the error in size detection for the virtual partition being added - Added the 'Partition analysis' method

exFAT file system: added control of likely boot record copy during file system detection in an exFAT partition for a $07 slot

Fixed the error preventing statistics from changing during multipass copying

Fixed the error resulting in incorrect use of the heads map during backwards reading based on the map

Fixed the error in map statistics calculation (taking into account the missing chains, such as sparsed, etc.)

Fixed the error causing 'capturing' of two extra sectors under specific conditions during backwards reading with enabled option to jump upon readiness loss or upon reading errors

Changed GPT parsing (previously interrupted at the first 'empty' slot)

Fixed the GPT parsing error for sectors different from 512 bytes.

Added forensics features:

- Implemented hash (MD5, SHA1) calculations for a chain within a map and an entire map, and also for a file in explorer view - Implemented the functionality that allows exporting the lists of directories and files to a CSV with an opportunity to define the data set, calculate checksums (MD5, SHA1) and control the presence of unread sectors or sectors read with errors

NTFS:

- New implementation of the 'Partition analysis', 'Scan unused space', and 'Search NTFS structures' modes) - Fixed the error in the MFT record editor occurring with partitions larger than 2 Tb - Fixed the error causing incorrect generation of the used/unused space maps for partitions produced as a result of MFT scan

HFS+ file system:

- New implementation of scan methods (CatalogFile, partition, used/unused space within a partition) - Added hardlink support (with hardlink copying and opening of the source file) - Fixed the error in support functionality for additional extends Fixed the error in Apple Partition Map interpretation for sector sizes other than 512 bytes - Fixed the error occurring during generation of the used space map for drives using sector size larger than 512 bytes - Fixed the error occurring during addition of a large virtual partition in the disk analysis mode (incorrect partition size setting)

FAT file system:

- Long names without integrity control are now used for deleted files and folders (previously short names were used) - Fixed the error in generation of the used/unused space maps for a partition (the last chain was ignored)

EXT2 (3, 4) file system:

- Generation of the used/unused space maps has been enhanced with the ability to take into account Bitmap sectors, which could not be read or have been read with errors - Revised the procedure of block number validity control in parsing of file system metadata

Raw recovery mode:

- Added the opportunity to group file/structure types by categories - Fixed the error occurring while adding a record to the general raw recovery reference - Defined more precisely the criteria used to check some file types - Fixed the error in detection of the checked TIFF file size - Fixed the error occurring while importing the general raw recovery reference - Added in the raw recovery reference the opportunity to export/import its content to/from an external file - Added an opportunity to export the raw recovery results to a CSV file

Added in the GREP reference the opportunity to export/import its content to/from an external file

Introduced additional control of identification data of the devices connected to standard ports while opening a task

Added the opportunity to display in the sources list the drives connected to the standard ports and used at the moment

Changed the mode employed to control the ports/drives in use and open tasks (used ports/drives do not appear now in the lists or appear with a warning icon, tasks remain inaccessible)

Increased writing timeout for the HDD connected to standard ports (which was insufficient for some newer "green" 2-3 Tb drives failing to wake up and resulting in writing/reading error on the destination drive)

Eliminated map "jumping" during tab switching

'Statistics' item added to the main menu of the task window (for copy creation tasks)

Fixed an old error causing "gaps" during copy creation in image files (very rare in case of straight forward copying and more often during backward copying)

Fixed the situation when sector reading interrupted in sector editor caused termination of the running process

Changed the task name input dialog

File size filter now starts from 1 byte (previously: from 1 Kb)

Added power management functionality in the object map mode

Added the opportunity to save files with problems to a separate directory (preserving the paths) while saving files

Removed the file saving dialog with information about files with problems. A file is now saved automatically under a unique name including complete date and time. Appropriate message is output to Log

Supplemented the Log context menu with the command to open file (invoked by highlighting the necessary block and right-clicking it)

Optimized the performance of 'Raw recovery' and 'Disk analysis' modes. Performance of the raw recovery mode increased by 20-30%, disk analysis accelerated several times (which is important during the complete analysis stage)

Added output of the message about successful creation of a virtual partition to Log

Added the dialog that allows partition creation from a specific LBA during creation of a virtual partition with unconfirmed structure

NTFS: if MFT scanning reveals no $bitmap, the corresponding menu item is inaccessible in the analysis results

Added a new 'Disk analysis' mode to replace the earlier 'Quick disk analysis' mode. It is performed in two stages (quick and complete), the results appear in the list immediately providing an opportunity to estimate them from the viewpoint of data recovery (delete if the data pose no interest, exclude a range of sectors in resulting data from further operations)

Added the 'Comment' field in the raw recovery results to display additional information for the specific result type (structure or file)

Added in the log menu the 'Open as LBA' command that allows to highlight in the log a numeric value and immediately open it in the sector editor

Revised the rule used to generate a new file name for file duplicates encountered while saving with the 'rename' option. Now file extension is preserved and its name is supplemented with the date and time

XFS: fixed errors in the procedures generating the directory and file map for some rare storage forms of file/directory descriptions

EXT file system: fixed the error in the calculation of the initial sector of a file for large (>2 Tb) partitions

Implemented interruption of the copying procedure and information output to the report for compressed NTFS files with unread sectors or sectors read with errors if the appropriate option is enabled

Enhanced the functionality for map generation for a directory (or selected files and directories) with an opportunity to calculate the estimated total size of the files based on their descriptors without actual generation of their placement map

The button disabling caching is transformed into a trigger (on/off).

HFS+: fixed the error, which could prevent opening of HFS+ partitions in case of Apple Partition Map

Fixed memory leak caused by fragmentation during execution of two or more tasks saving files in explorer and/or saving a copy to a drive connected to standard system ports

NTFS: upon completion of MFT scanning, the number of found valid MFT records is now output to the Log

EXT2 (3, 4) file system:

- Added the functionality to take into account read errors while building a bitmap-based map of used/unused space - For addition of virtual partition from the raw recovery results, added the functionality to take into account the copy of group descriptors table, which allows to recover data in case of erased or corrupted first superblock and the table of group descriptors

For copy creation tasks, added the opportunity to save some settings as defaults for future tasks (with the button on the first tab in the settings dialog)

Implemented the 'open with' method for files in the explorer view;

Fixed the error occurring in clearing the original task map during data export from the object map and explorer views and to another drive connected to the standard system ports

Fixed the looping error encountered during backward copying of chains containing sectors with problems at the chain border and with the block size of 1 sector

FAT file system:

- Added integrity control for the FAT sectors being analyzed - Added one-time automatic start of the 'Partition analysis' mode if the root directory is empty

ReiserFS: accelerated generation of file maps

HFS+ file system:

- Improved generation of the map for selected files based on the root directory - Significantly accelerated generation of files map for a virtual partition produced as a result after scanning - Significantly optimized and accelerated processing of results obtained after Catalog file scanning - Significantly optimized and accelerated operations with the native file system including opening of directories, search and generation of maps - Changed the Volume Header viewing window

NTFS:

- Optimized and revised the 'Search NTFS structures' and 'Partition analysis' modes - The map of a nonresident directory now includes parts marked as unused in the attribute (B0) - 'Partition analysis' mode now includes a request for a complete rescan